fittings-valid-iban

SUSPICIOUS. The skill’s stated purpose is coherent, and the API domain matches that purpose, but it relies on a remotely downloaded, unverifiable client script that is later executed and given a wallet private key for payment signing. That combination is disproportionate to simple IBAN validation and creates a high supply-chain and credential-forwarding risk even without clear evidence of outright malware.